Practically secure quantum bit commitment based on quantum seals 
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The relationship between the quantum bit commitment (QBC) and quantum seal (QS) is stud- 
ied. It is elaborated that QBC and QS are not equivalent, but QS protocols satisfying a stronger 
unconditional security requirement can lead to an unconditionally secure QBC. In this sense, QS 
is strictly stronger than QBC in security requirements. Based on an earlier proposal on sealing a 
single bit, a feasible QBC protocol is also put forward, which is secure in practice even if the cheater 
has a strong quantum computational power. 
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I. INTRODUCTION 

Bit commitment (BC) is a cryptographic task between 
two participants Alice and Bob. It normally includes 
two phases. In the commit phase, Alice has in mind a 
bit {b — or 1) which she wants to commit to Bob, and 
she sends him a piece of evidence. Later, in the unveil 
phase, Alice announces the value of 6, and Bob checks it 
with the evidence. A BC protocol is said to be binding 
if Alice cannot change the value of b after the commit 
phase, and is said to be concealing if Bob cannot know 
b before the unveil phase. A secure BC protocol needs 
to be both binding and concealing. Quantum bit com- 
mitment (QBC) [Ij is known to be an essential element 
for building more complicated "post-cold- war era" multi- 
party cryptographic protocols, e.g., quantum coin tossing 
and quantum oblivious transfer [2, _3] . Unfortunately, ac- 
cording to the Mayers-Lo-Chau (MLC) no-go theorem 
[J, Q, unconditionally secure QBC does not seem to ex- 
ist in principle. On the other hand, quantum seals (QS) 
are relatively new to quantum cryptography. Its goal can 
be summarized as follows. Alice, the owner of the secret 
data to be sealed, encodes the data with quantum states. 
Any reader Bob can obtain the data from these states 
without the help of Alice, while reading the data should 
be detectable by Alice. A QS protocol is considered to be 
secure if it possesses the following feature: Bob cannot 
escape Alice's detection once he reads the data, namely. 
Bob is unable to read the data if he wants to escape Al- 
ice's detection. QS can be classified by the types and the 
readability of the sealed data. If the data is a classical bit, 
it is called quantum bit seals (QBS). Else if the data is a 
classical string, it is called quantum string seals (QSS). If 
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the data can always be obtained by the reader with cer- 
tainty, it is called a perfect QS. Else if the data can only 
be obtained with a small but non-vanished error rate, it 
is an imperfect QS. The first perfect QBS protocol was 
proposed by Bechmann-Pasquinucci 6], but then it was 
proven that all perfect QBS ones are insecure against col- 
lective measurements |7|. Shortly later, it was also found 
that imperfect QBS has security limi ts |8 |. Nevertheless, 
the imperfect QSS can be secure [I, [il|ll[ll, [H, ^. 
More intriguingly, it was proposed in Ref. [9[ that secure 
QSS can be utilized to realize a kind of QBS, which is 
secure in practice. 

Though QBC and QS may look like irrelevant at the 
first glance, here we elaborate that they are closely re- 
lated. More rigorously, it will be shown below that a QBS 
protocol satisfying certain security conditions can lead to 
an unconditionally secure QBC. Based on the method of 
realizing QBS with QSS in Ref. P|, a new QBC proto- 
col is obtained. A most intriguing feature of this QBC 
protocol is that the present QBS protocol enables the se- 
cret data to be decoded with common senses of human 
being, thus it is very easy for an honest participant. On 
the contrary, a dishonest participant cannot fulfill the 
coherent attacks even if he has a very powerful quan- 
tum computer that can perform any kind of quantum 
operations and measurements. Instead, he needs also a 
knowledge base that has almost all knowledge of human 
culture, and his quantum computer needs to have a high 
level of artificial intelligence to handle these knowledge. 
This is impossible not only for current technology, but 
also is less likely in practice even in the future, because 
human intelligence seems to contain non-computable ele- 
ments [15i]. In this sense, the present QBC protocol may 
be viewed as "practically secure". Moreover, this QBC 
is quite feasible. Thus it is possible to build more com- 
plicated QBC-based multi-party cryptographic protocols 
and to enjoy the advantage of quantum cryptography in 
practice, even though the MLC no-go theorem is still 



there. 



II. THE RELATIONSHIP BETWEEN 

QUANTUM BIT COMMITMENT AND 

QUANTUM SEALS 

For a QBS protocol with a known error rate e, we can 
build a QBC protocol as follows (note that in this section, 
the names Alice and Bob are called contrarily to those 
in the description of QS in the Introduction, because the 
QBS protocol is executed in the reverse direction in the 
QBC protocols below). 

The Basic Protocol 

The commit phase: 

(1) Bob randomly chooses s bits Xi {i = 1, ..., s), and 
seals each bit into a quantum register ipi {i — l,...,s) 
with the QBS protocol. Then he sends these quantum 
registers to Alice. 

(2) Alice randomly chooses m of the quantum registers 
and decodes their corresponding sealed bits. She checks 
if the values of these m sealed bits are random. She also 
asks Bob to reveal the values of the sealed bits for these m 
quantum registers to check if they match the values she 
decoded within the error rate e. If no suspicious result 
was found, Alice and Bob discard the data for these m 
quantum registers and proceed. 

(3) Alice randomly chooses one of the remaining s ~m 
quantum registers (suppose that it is ipig), decodes the 



sealed bit Xi^ , and leaves the rest s 
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registers unmeasured. Now she has in mind the value of 
the bit b she wants to commit, and announces to Bob the 
value of a = Xi„ © b. 

The unveil phase: 

(4) Alice announces to Bob the value of the commit 
bit b and io, and sends Bob all the s — to — 1 unmeasured 
quantum registers. 

(5) Bob uses the value Xi^ he sealed in ■(/'io to check 
whether a — Xi„ ® 6, and he checks whether the s ^m — 1 
quantum registers Alice returns him in this phase are 
indeed unmeasured, i.e., the corresponding sealed bits 
have not been decoded. He accepts Alice's commitment 
as honest if no suspicious result was found. 

This protocol is concealing because Bob cannot know 
io before the unveil phase, since Alice's announcing a 
provides him 1 bit of information only, while locating io 
requires log2(s — rn — 1) bits of information. Therefore 
Bob does not know Xi„ so he cannot infer the value of the 
commit bit 6 from Alice's announced a, as long as each 
Xi has the equal probabilities to be or 1 (that is why 
Alice needs to check in step (2) whether the values of 
the sealed bits are random). It is also binding because if 
Alice wants to change the value of b in the unveil phase, 
she has to find another quantum register ipi-^ whose sealed 



bit is lij = Xig , and sends ipig to Bob as an unmeasured 
quantum register in step (5). But if the QBS protocol 
used in this QBC protocol is secure, Bob will detect that 
the bit sealed in ipi^ has already been decoded, and catch 
Alice cheating. 

However, Alice can apply the following weak cheating 
strategy. She measures no register in step (3), and an- 
nounces a random value as a. Then in the unveil phase, 
she randomly chooses a register as V'io j ^^id determines 
what value of b can be announced in step (4) according 
to the decoding result of her current measurement on ipi^ 
and the value of a she previously announced. This may 
not be considered as a "real" cheating because Alice can- 
not announce b at her will in the unveil phase. It is like 
tossing a coin and decide the value of b by the head or 
tail. But on the other hand, it is also true that the proto- 
col cannot limit Alice to honest behaviors because she is 
not forced to make up her mind on the value of b during 
the commit phase. To fix this problem, we can further 
improve the protocol. 

The Advanced Protocol 

The commit phase: 

(i) Alice and Bob agree on the security parameters s, 
m and n (n << s — m), and a Boolean matrix G as the 
generating matrix of a binary linear (n, k, d)-code C [16|. 

(ii) The same as steps (1) and (2) of the basic protocol. 

(iii) Alice randomly chooses n of the remaining s — 
m quantum registers. Suppose that they are ipj {j = 
ii, Z2, ..., in, ii < i2 < ... < in)- She decodes each of the 
bit Xj sealed in these n registers, and leaves the rest s — 
m — n quantum registers unmeasured. Thus she obtains 
a classical n-bit string x — {xi^Xi^...Xi^). 

(iv) Alice chooses a non-zero random n-bit string r = 
(rir2...r„) G {0, 1}" and announces it to Bob; 

(v) Now Alice has in mind the value of the bit b that 
she wants to commit. She chooses an n-bit codeword 
c = (ciC2...c„) from C such that cQr = b (Here cQr = 

n 

®c,Ar,); 
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(vi) Alice announces to Bob c' = a 



)X. 



The unveil phase: 

(vii) Alice announces to Bob the value of the commit 
bit b and ?i, «27 ■•■, im and sends Bob all the s — m — n 
unmeasured quantum registers. 

(viii) Bob uses the values Xj he sealed in ipj {j ~ 
ii,i2, ■■■,in) to obtain c from c' = c (B x, and checks 
whether c is indeed a codeword from C and cQr ~ b. He 
also checks whether the s — m ~ n quantum registers Al- 
ice sends him in this phase are indeed unmeasured, and 
accepts Alice's commitment as honest if no suspicious 
result was found. 

The intuition behind this protocol is that if Alice wants 
to keep the value of b undetermined in the commit phase 
by measuring less than n registers in step (iii), she has 



to announce c' randomly in step (vi) since she does not 
know X. Then in step (vii) of the unveil phase, she has to 
find the correct indices 11,12, ■■■, in to announce, so that 
the data x = {xi-^Xi^...Xi^) sealed in tpj (j = 11,12, ■■■,in) 
ensures that c' ®x is a codeword from C . Generally, if she 
randomly chooses n indices to announce while leaving the 
rest s~m — n quantum registers completely unmeasured, 
the probability is trivial for the value of x thus obtained 
to be exactly what needed. The question is whether the 
following strategy can be successful: In the unveil phase, 
Alice randomly chooses n quantum registers and mea- 
sures them with collective measurements instead of indi- 
vidual measurements, so that they can be less disturbed 
if their sealed data is not the desired x. Then Alice can 
repeat the procedure with other sets of n registers, until 
she finally finds the set in which the desired x is sealed. 
In this case, whether the above QBC protocol is secure 
or not will be determined by how much disturbance is 
caused by Alice's collective measurements. That is, it is 
determined by the security level of the QBS protocol used 
in step (ii). To find out how secure this QBS needs to be, 
let us first review the classification of definitions of secu- 
rity of cryptographic protocols. Currently, the following 
two definitions of security are widely adopted [J| . 

Perfect security: 

When the other participant (s) is (are) honest, the 
amount of extra information (other than what is allowed 
by the protocol) obtained by the dishonest participant (s) 
is exactly zero. 

Unconditional security: 

When the other participant (s) is (are) honest, the 
amount of extra information obtained by the dishonest 
participant (s) can be made arbitrarily small by increas- 
ing the security parameter(s) of the protocol. 

Obviously when perfectly secure QBS protocols are 
used in Advanced Protocol, it will result in an uncondi- 
tionally secure QBC. What we are interested is whether 
unconditionally secure QBS protocols are useful too. 
Note that the above definition of unconditional security is 
equivalent to: when the other participant (s) is (are) hon- 
est, the probability for a dishonest participant to obtain 
non-trivial amount of extra information while escaping 
the detection can be made arbitrarily small by increas- 
ing the security parameter(s) of the protocol. However, it 
was left blank in this definition whether the probability 
for a dishonest participant to escape the detection can 
be made arbitrarily small if he obtains trivial amount of 
extra information only. To be rigorous, here we propose 
an independent definition for a kind of unconditionally 
secure protocols which satisfies stricter security require- 
ment. 

Strong unconditional security: 

When the amount of extra information obtained by 
a dishonest participant is f{n) (here f{n) is a function 



whose value decreases as the security parameter(s) n of 
the protocol increases) , the probability for him to escape 
the detection by the honest participant(s) is o(a-^'^"^). 
Here the constant a satisfies < a < 1. 

Now let us see what difference will be made when dif- 
ferent kinds of unconditionally secure QBS protocols are 
used in the above Advanced QBC Protocol. Suppose that 
Alice applies the cheating strategy mentioned above. She 
measures no quantum registers in the commit phase. In 
the unveil phase, she randomly chooses n registers and 
measures them with collective measurements. If it turns 
out that the data sealed in these registers is exactly the 
desired x that could lead to the value of b she wants 
to unveil, then her cheating is successful. Else she tries 
again with another set of n registers. Note that in the 
latter case, she merely knows that the data sealed in the 
first n registers she measured is not x, while she does not 
know what exactly the sealed data is. Thus the amount 
of information she obtained is merely f{n). If general 
unconditionally secure QBS protocols are adopted which 
do not satisfy the strong unconditional security condi- 
tion, Alice can escape the detection with a probability 
not less than 0{a^^"'^). Suppose that it averagely takes 
t times for Alice to perform collective measurements on 
different sets of n registers until she finds the desired n 
registers which give the outcome x she is looking for. 
Since the goal of Alice is to commit 1 bit of information, 
we have tf{n) ~ 0(1), i.e., tf{n) has a finite non-trivial 
value. Then the probability for Alice to escape the detec- 
tion will be not less than [©(a-'^^"))]* ~ ©(a*-''^")), which 
also remains finite instead of being trivial as n increases. 
Thus we come to the conclusion that unconditionally se- 
cure QBS which does not satisfy the strong unconditional 
security condition does not necessarily lead to uncondi- 
tionally secure QBC through the above Advance Proto- 
col. 

On the other hand, if strong unconditionally secure 
QS protocols are adopted in Advanced Protocol, when- 
ever Alice measures n registers and obtains f{n) bits of 
information, she can escape the detection with probabil- 
ity o(a'^'^"-') only. That is, when she finally finds the n 
registers she is looking for and thus obtains finite non- 
trivial amount of information, the probability for her to 
escape the detection will be ~ o(a*^*^"-'), which does not 
remain finite. Instead, it drops arbitrarily close to zero as 
n increases. Consequently, the resultant QBC protocol 
is unconditionally secure. Therefore we reach one of the 
main result of this paper: strong unconditionally secure 
QBS can lead to unconditionally secure QBC. 

It is natural to ask a further question whether strong 
unconditionally secure QBS and unconditionally secure 
QBC are equivalent. So far, to our best knowledge, no 
unconditionally secure QBS protocol based on uncondi- 
tionally secure QBC (no matter it exists or not) was ever 
proposed. It is also worth noting that the definitions of 
QBS and QBC indicate a significant different feature be- 
tween them. In the final stage of QBC, Alice needs to 



unveil to Bob what she committed, i.e., classical comm.u- 
nication is needed. On the contrary, in QBS Alice can 
check whether the sealed data was decoded or not at any 
time, with or without the classical communication from 
Bob. Therefore it seems reasonable that an uncondition- 
ally secure QBS protocol based on unconditionally secure 
QBC does not exist at all. For these reasons, we tend 
to believe that strong unconditionally secure QBS and 
unconditionally secure QBC are not equivalent. Strong 
unconditionally secure QBS is strictly stronger than un- 
conditionally secure QBC in security requirements. 



III. PRACTICALLY SECURE QUANTUM BIT 
COMMITMENT PROTOCOL 



In Ref. [8], a model of QBS was proposed and it was 
proven that any QBS satisfying this model cannot be un- 
conditionally secure. To date, the model seems to cover 
all QBS protocols within our current imagination. Con- 
sequently, before we can come up with a protocol which 
satisfies the definition of QBS exactly while is not cov- 
ered by that model, unconditionally secure QBS does not 
seems to exist in principle. Therefore no QBS can lead 
to unconditionally secure QBC via the above Advanced 
Protocol. Nevertheless, it was shown in Ref. that un- 
conditionally secure QSS exits, and it can lead to QBS 
which is secure in practice. Therefore we can use this 
QBS to realize a kind of QBC which is also secure in 
practice. 

Let us briefly review the QSS and QBS protocols pro- 
posed in Ref. @. Let 9 (0 < 9 < n/A) and a 
(0 < a < 1/2) be two fixed constants. The proposed 
QSS protocol is as follows. 

Sealing: To seal a classical A^-bit string b = 6i&2---^iv 
(b, e {0, 1}), Ahce randomly chooses 6, {-Q/N" < 6*, «: 
9/A^") and encodes each bit bi with a qubit in the state 
\ipi) = cosdi \bi) + sindi \bi). She makes these n qubits 
publicly accessible to the reader, while keeping all 9i [i = 
1, ■■■,N) secret. 

Reading: When Bob wants to read the string b, he 
simply measures each qubit in the computational basis 
{|0) , |1)}, and denotes the outcome as |&^). He takes the 
string b' — b'ib'2...b'j^ as b. 

Checking: At any time, Alice can check whether the 
sealed string b has been read by trying to project the i-th 
qubit (i = 1, ..., N) into cos^i \bi)+sin9i Ibi). If all the A^ 
qubits can be projected successfully, she concludes that 
the string b is still unread. Otherwise if any of the qubits 
fails, she knows that b is read. 



the detection is bounded by 



N 



This protocol can achieve the following goal: each bit 
sealed by Alice can be read correctly by Bob, except with 
a probability not greater than e = sin^(9/A^"). Thus by 
increasing N^ the maximal reading error rate e can be 
made arbitrarily small. Meanwhile, the total probability 
for Bob to obtain K bits of information while escaping 
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which drops exponentially as AT — > A^, and vanishes when 
A^ -^ oo as long as < a < 1/2. Thus the protocol is 
unconditionally secure in principle. 

This QSS protocol can be utilized to seal a single bit. 
The method is to turn the sealed bit into a string by 
adding redundant information. There are many ways 
to accomplish this. In the simplest case, we can map 
some global properties of the string, e.g., the parity or 
the weight, into the bit we want to seal. But since such 
kinds of mapping is easy to be formulated mathemati- 
cally, a cheater with a powerful quantum computer can 
construct a proper collective measurement correspond- 
ing to the mapping, and reads the sealed bit with the 
strategy proposed in Ref. [gl so that he can escape the 
detection with a non-trivial probability. Hence the pro- 
tocol is easy to be broken. But in practice, we can make 
it more difficult to know the rule of the mapping dis- 
honestly than to do so honestly. One of such methods 
is to translate the sentences describing the rules of the 
mapping into a classical binary bit string, and seal it as 
a part of the sealed string so that the cheater does not 
know the mapping before decoding the string. 

For example, Alice can first encode the following sen- 
tence into a classical binary bit string 

^'Measure the last two qubits in the basis 

{cos 15° |0) + sin 15° |1) , - sin 15° |0) + cos 15° |1}} 

and you will know the value of the sealed bit from 

their parity. Other qubits following this sentence 

are all dummy qubits. You can simply leave them 

alone." 

Then she seals it with our QSS protocol, and provides 
Bob the qubits encoding this sentence, followed by a large 
number of qubits where only the last two are actually 
useful. 

We must point out that this bit sealing method is still 
insecure in principle. This is because any given classical 
A^-bit string can be decoded into one specific sentence 
only, and the meaning of the sentence will lead to a value 
of the sealed bit unambiguously. As long as a dishon- 
est Bob knows the length A^ of the sealed string, he can 
study all the 2^ possible classical A^-bit strings, decode 
them into sentences, and divide these sentences into two 
subsets corresponding to the two possible value of the 
sealed bit (of course there will also be tons of meaning- 
less sentences and even random sequences of bits that 
cannot be decoded as sentences. Bob can simply leave 
them alone). Then as described in Ref. [g], he needs 
not to know the content of the sealed sentence exactly. 
He simply constructs a proper collective measurement to 
determine which subset the sentence belongs to. Thus 



he will know the sealed bit from the TV qubits without 
disturbing them seriously. 

Nevertheless, if A'" is sufficiently large, the number of 
possible sentences will be enormous. There could be sen- 
tences as simple as 

"/i is 0. Ignore the rest qubits. ^^ 

But there are also sentences like 

^^Decode the bits following this sentence as a 
bitmap image and count the parity of the 
number of females. ^^ 

and followed by the bits encoding an image of animals, 
or famous cartoon icons, or a picture as shown in Fig. 1. 
For an honest participant who docs not mind disturbing 
the quantum state sealing the string, he can simply de- 
code the whole string and learn the value of the sealed 
bit easily. But for a dishonest participant who wants to 
keep the quantum state less disturbed so that he can es- 
cape the detection, he does not know beforehand what 
kind of the sentences he will encounter. To decode the 
sealed bit with collective measurements, he has to build 
a data base which contains all sentences, pictures, and 
even wave files for voice messages, etc., which can be en- 
coded as A^-bit strings. More importantly, learning the 
sealed bit from pictures such as Fig. 1 is easy for human 
beings with common senses, while if it is expected to be 
done by machine, it has to have advanced power on im- 
age identifying, pattern matching, and the capability to 
understand the meaning of pictures, which may require 
a large coverage of the knowledge of science and culture 
in human history. It is actually impossible in practice 
for a cheater to build such a data base for sufficiently 
large values of N, even he has the most powerful quan- 
tum computer. Thus his collective measurements cannot 
be constructed. In this sense, such QBS can be viewed 
as secure in practice. 

With the above results of Ref. [9|, building a QBC 
protocol is straight forward. We can simply apply this 
"practically secure" QBS protocol in Advanced Protocol 
to obtain a QBC protocol. Note that the "practically 
secure" QBS does not satisfy the strong unconditional 
security condition. In fact, it is not unconditionally se- 
cure in principle at all. Consequently, the resultant QBC 
protocol is not unconditionally secure in principle. But 
since the above QBS cannot be broken in practice, the 
resultant QBC, whose security completely determined by 
the QBS protocol being based on, is also secure in prac- 
tice. Especially, when N is sufficiently large, there will 
inevitably some sequences of bits which can be decoded 
incidcntly as sentence like 

^^Go to the main library. Find the book on the 
top — left of the last shelf. Turn to the last page, 
and count how many times the letter K occurs 
in the 3rd line " 




FIG. 1: A picture that may be used to seal a single bit in 
practice. 



Though such a sentence may lead to a deterministic value 
of the sealed bits, it is less likely that the bit is really 
sealed this way according to common sense. Therefore 
a cheater can simply keep such sentences out of consid- 
eration in a QBS protocol. Nevertheless, in our QBC 
protocol we can allow Bob (again, please note that the 
names Alice and Bob called in Advanced Protocol are 
contrary to those in QBS) to seal such ridiculous sen- 
tences (and even meaningless sentences which is literally 
correct but may contain no clue for the sealed bit) with a 
certain probability which is also agreed by Alice. When- 
ever Alice decodes such a sentence in step (iii), she can 
tell Bob to discard the corresponding data and chooses 
another quantum register to measure. This will make 
the protocol even more secure because if Alice wants to 
cheat, her quantum computer will also have to deal with 
all ridiculous and meaningless sentences, and judge which 
sentences make sense. To accomplish this, it seems that 
the quantum computer needs not only unlimited compu- 
tational power to perform any kind of quantum opera- 
tion and measurement, but also some extent of artificial 
intelligence. So far there is even debate on whether hu- 
man intelligence is computable or not [l5| . Therefore the 
security of our protocol is further guaranteed by those in- 
computable elements. As a result, though the MLC no- 
go theorem is considered to have put a serious drawback 
on the development of the theoretical aspect of quantum 
cryptography, in practice we can simply bypass this the- 
orem and go ahead with this "practically secure" QBC 
protocol. After all, the main purpose of developing cryp- 
tography is to satisfy the application needs of human 
society, which involve not only physical and mathemati- 
cal principles, but also human behaviors. Cheating itself 
is exactly a creation of human intervention. Therefore 
it is natural to introduce more human-related issues into 
cryptography to prevent cheating. Our finding makes it 
possible to building any complicated QBC-based "post- 
cold- war era" multi-party cryptographic protocols, like 



quantum coin tossing and quantum oblivious transfer, 
and achieve better security in practice which cannot be 
reached by their classical counterparts. 



IV. FEASIBILITY 

The present QBC protocol can be implemented as long 
as the based-on QS protocol can be realized. As pointed 
out in Ref. J9|, the QS protocol requires merely Al- 
ice to have the ability to prepare each single qubit in 
a pure state, and Bob to perform individual measure- 
ments. No entanglement/collective-measurement is re- 
quired. Therefore the protocol may be demonstrated and 
verified by the techniques available currently. Of course 
for practical uses, storing quantum states for a long pe- 



riod of time is still a technical challenge today. But this 
is a tough issue that all QS protocols have to suffer. The 
present protocol may be one of the simplest protocols of 
its kind. More significantly, if such technique of storing 
quantum states is not available, the attack strategy pro- 
posed by the MLC no-go theorem that makes previous 
QBC (e.g, Ref. U^) insecure cannot be implemented ei- 
ther; but on the other hand, whenever this tough techni- 
cal problem is resolved in the future, the previous QBC 
would be broken quite easily, while our QBC protocol 
may still remain to be secure in practice. 
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